﻿# -------------------------------------- #
# Network Security Group (NSG) Functions #
# -------------------------------------- #

# Add Network Security Groups
function Add-NetworkSecurityGroups([System.Xml.XmlElement]$subscription)
{
	if (!(Should-Run($subscription.networkSecurityGroups))) {return}
	foreach ($networkSecurityGroup in $subscription.networkSecurityGroups.networkSecurityGroup)
	{
	    if (!(Should-Run($networkSecurityGroup))) {continue}
		Write-Information "Adding Network Security Group '$($networkSecurityGroup.name)' ... " -NoNewLine $true
	    if (Get-AzureNetworkSecurityGroup | ? {$_.Name -eq $networkSecurityGroup.name})
		{
			Write-Text "skipped."
		}
		else
		{
		    New-AzureNetworkSecurityGroup -Name $networkSecurityGroup.name -Location $networkSecurityGroup.location -Label $networkSecurityGroup.label | Out-Null
		    if (!$?) {throw "Network Security Group '$($networkSecurityGroup.name)' operation failed."}
			Write-Text "done."
		}
        $networkSecurityGroupInstance = Get-AzureNetworkSecurityGroup -Name $networkSecurityGroup.name -Detailed
        Remove-NetworkSecurityGroupRules $networkSecurityGroup $networkSecurityGroupInstance
        Add-NetworkSecurityGroupRules $networkSecurityGroup $networkSecurityGroupInstance
	}
}

# Remove Network Security Groups
function Remove-NetworkSecurityGroups([System.Xml.XmlElement]$subscription)
{
	if (!(Should-Run($subscription.networkSecurityGroups))) {return}
	foreach ($networkSecurityGroup in $subscription.networkSecurityGroups.networkSecurityGroup)
	{
	    if (!(Should-Run($networkSecurityGroup))) {continue}
	    if (Get-AzureNetworkSecurityGroup | ? {$_.Name -eq $networkSecurityGroup.name})
		{
		    Write-Information "Removing Network Security Group '$($networkSecurityGroup.name)' ... " -NoNewLine $true
		    Remove-AzureNetworkSecurityGroup -Name $networkSecurityGroup.name -Force | Out-Null
		    if (!$?) {throw "Network Security Group '$($networkSecurityGroup.name)' operation failed."}
			Write-Text "done."
		}
		else
		{
		    Write-Information "Removing Network Security Group '$($networkSecurityGroup.name)' ... skipped."
		}
	}
}

# Add new Network Security Group Rules
function Add-NetworkSecurityGroupRules([System.Xml.XmlElement]$networkSecurityGroup, $networkSecurityGroupInstance)
{
    foreach ($rule in $networkSecurityGroup.rules.rule)
    {
        if (($networkSecurityGroupInstance.Rules | ? {$_.Name -eq $rule.name}) -eq $null)
        {
		    Write-Information "Adding Network Security Group '$($networkSecurityGroup.name)' rule '$($rule.name)' ... " -NoNewLine $true
            Set-AzureNetworkSecurityRule -Name $rule.name -Type $rule.type -Priority $rule.priority `
                -SourceAddressPrefix $rule.sourceAddressPrefix -SourcePortRange $rule.sourcePortRange -DestinationAddressPrefix $rule.destinationAddressPrefix -DestinationPortRange $rule.destinationPortRange `
                -Protocol  $rule.protocol -Action $rule.action -NetworkSecurityGroup $networkSecurityGroupInstance | Out-Null
		    Write-Text "done."
        }
    }
}

# Remove deleted Network Security Group Rules
function Remove-NetworkSecurityGroupRules([System.Xml.XmlElement]$networkSecurityGroup, $networkSecurityGroupInstance)
{
    foreach ($rule in $networkSecurityGroupInstance.Rules)
    {
        if ($rule.Priority -le 4096 -and ($networkSecurityGroup.rules.rule | ? {$_.name -eq $rule.Name}) -eq $null)
        {
		    Write-Information "Removing Network Security Group '$($networkSecurityGroup.name)' rule '$($rule.name)' ... " -NoNewLine $true
            Remove-AzureNetworkSecurityRule -Name $rule.Name -NetworkSecurityGroup $networkSecurityGroupInstance -Force | Out-Null
		    Write-Text "done."
        }
    }
}